Authentication and API keys

Every API call carries a key. A key belongs to the account it was created in, and everything made with it is that account's usage and is charged to that account's credit.

Send the key#

Send it as a bearer token, as OpenAI's clients do, or in an x-api-key header, as Anthropic's clients do. Both carry the same key.

curl https://sven.swedishembedded.com/v1/models \
  -H "Authorization: Bearer $SVEN_API_KEY"

A call with no key, or a key that is unknown, expired or removed, is answered 401 with an authentication_error.

Create a key#

Open API keys and choose Create.

• Name (optional, up to 60 characters). Give each application its own key and name it after the application. Usage is reported per key, so the name tells you where spending came from.
• Models. Allow the key to call every model, including ones added later, or choose the few it may call. A restricted key that asks for another model is answered 403, and its model list shows only the models it may call.

The key is shown once, when it is made. Copy it then. If you lose it, create another and remove the old one.

Only an admin of an organisation can create, restrict, limit or remove keys, because a key spends the organisation's money. In a personal account the owner can.

Cap what a key can spend#

Each key can have a lifetime spending limit. Choose Spending limit on its row, enter an amount in dollars, and the key stops working for new calls once what it has been charged reaches it. A call that would take it past the limit is refused with 402 and the code key_spend_limit, before anything runs. Raise or remove the limit to continue.

The account has a second, separate cap: its monthly budget, which refuses calls with the code monthly_budget.

Remove a key#

Choose Remove on the key's row. It stops working within seconds. The row shows when each key was last used, which helps you find keys nothing uses any more.

To rotate a key without a gap, create the new one, deploy it, check that the old one is no longer used, then remove the old one.

Keep keys safe#

• Keep a key on your servers. Never put it in a web page, a mobile app or a public repository: anyone who has it can spend your credit.
• Read it from the environment or a secrets store, not from source code.
• Use one key per application, and restrict it to the models that application needs.
• Set a spending limit on any key that is not fully under your control.
• If a key may have leaked, remove it at once and create a replacement.

The same key in sven#

A key is for your own software. The sven terminal signs in to your account on its own and does not need one. See Your computer.